You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Updated Drupal core to '11.4.12' and contrib modules to resolve 16 security advisories. - #365
Subject includes ticket number as [#123] Verb in past tense.
Ticket number #123 added to description
Added context in Changed section
Self-reviewed code and commented in commented complex areas.
Added tests for fix/feature.
Relevant tests run and passed locally.
Changed
composer audit --locked on develop reports 16 advisories published on 4 November, and this branch brings it to 0. Drupal core goes from 11.4.11 to 11.4.12, the Symfony 7.4 components move from v7.4.22 to v7.4.23, the Symfony 8.1 components from v8.1.10 to v8.1.11, and 7 contrib modules take patch or minor releases.
15 of the advisories sit in Symfony components core depends on (http-foundation, http-kernel, routing, serializer, validator, yaml, filesystem, config, http-client), including CVE-2026-118514 (HEAD requests bypass access_control methods), CVE-2026-118516 (host placeholders match the start of the path) and CVE-2026-118515 (serializer builds UploadedFile from request data). The 16th is SA-CONTRIB-2026-299, a critical XSS in drupal/highlight_js below 1.3.1.
Only composer.json constraints and composer.lock change. Every patch in extra.patches applied without a re-roll, config.audit.ignore was already empty, and config/default/ is untouched. drush updb and drush cex have not been run locally against this branch, so a post-update hook that rewrites config would not show up in this diff. The phpstan/phpstan2.3.3 pin stays in place.
Drupal core - drupal/core, drupal/core-recommended and drupal/core-composer-scaffold11.4.11 to 11.4.12, pulling in Symfony v7.4.23 / v8.1.11, masterminds/html52.12.0, and symfony/cache-contracts and symfony/http-client-contractsv3.8.1.
drevops/website#358: The issue lists pending Composer updates for packages also updated in this PR, including Drupal core and highlight_js. It does not confirm that all listed updates are completed.
Possibly related PRs
drevops/website#362: Both PRs change Composer constraints for metatag, stage_file_proxy, and Symfony HTTP client, with differing constraint values.
Merge Risk: Minimal · up to 89227
The dependency updates have no identified merge-blocking issue. Normal deployment and compatibility checks remain appropriate.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the two main changes: the Drupal core bump to 11.4.12 and the contrib module updates made to resolve security advisories. The raw summary confirms the core constraint move from ~11.4.1…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the two main changes: the Drupal core bump to 11.4.12 and the contrib module updates made to resolve security advisories. The raw summary confirms the core constraint move from ~11.4.11 to ~11.4.12 and the raised contrib constraints in composer.json. The PR objectives describe the same updates and the advisory count. The title is specific and matches the changeset, so it passes.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Team
Run ID: f044ad2b-1fad-4f9c-bb4f-344e6660e1cf
Commits
Reviewing files that changed from the base of the PR and between 4b789dc and 892270c.
Files ignored due to path filters: 1
composer.lock is excluded by !**/*.lock
Files selected for processing: 1
composer.json
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.
✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.85%. Comparing base (4b789dc) to head (892270c). ⚠️ Report is 1 commits behind head on develop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A2Board worker 2AUTOMERGEPull request has been approved and set to automerge
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AlexSkrypnyk
added
A2
Before / After
Checklist before requesting a review
[#123] Verb in past tense.#123added to descriptionChangedsectionChanged
composer audit --lockedondevelopreports 16 advisories published on 4 November, and this branch brings it to 0. Drupal core goes from11.4.11to11.4.12, the Symfony 7.4 components move fromv7.4.22tov7.4.23, the Symfony 8.1 components fromv8.1.10tov8.1.11, and 7 contrib modules take patch or minor releases.15 of the advisories sit in Symfony components core depends on (
http-foundation,http-kernel,routing,serializer,validator,yaml,filesystem,config,http-client), including CVE-2026-118514 (HEAD requests bypassaccess_controlmethods), CVE-2026-118516 (host placeholders match the start of the path) and CVE-2026-118515 (serializer buildsUploadedFilefrom request data). The 16th is SA-CONTRIB-2026-299, a critical XSS indrupal/highlight_jsbelow1.3.1.Only
composer.jsonconstraints andcomposer.lockchange. Every patch inextra.patchesapplied without a re-roll,config.audit.ignorewas already empty, andconfig/default/is untouched.drush updbanddrush cexhave not been run locally against this branch, so a post-update hook that rewrites config would not show up in this diff. Thephpstan/phpstan2.3.3pin stays in place.drupal/core,drupal/core-recommendedanddrupal/core-composer-scaffold11.4.11to11.4.12, pulling in Symfonyv7.4.23/v8.1.11,masterminds/html52.12.0, andsymfony/cache-contractsandsymfony/http-client-contractsv3.8.1.drupal/captcha2.0.12,drupal/highlight_js1.3.1(security),drupal/key1.23.0,drupal/metatag2.2.6,drupal/photoswipe5.0.13,drupal/shield1.11.0,drupal/stage_file_proxy4.0.2.consolidation/*libraries patched,mglaman/phpstan-drupal2.2.2to2.3.0,symfony/browser-kitv8.1.11.Security advisories resolved
drupal/highlight_js1.3.1symfony/configXmlUtils::parse()v8.1.11symfony/filesystemv7.4.23symfony/http-clientv7.4.23symfony/http-clientNoPrivateNetworkHttpClientv7.4.23symfony/http-foundationaccess_controlmethodsv7.4.23symfony/http-foundationv7.4.23symfony/http-foundationprivate_rangestrusts mapped IPv6 clientsv7.4.23symfony/http-foundationv7.4.23symfony/http-kernelv7.4.23symfony/routingv7.4.23symfony/serializerUploadedFilebuilt from request datav7.4.23symfony/serializerDataUriNormalizerreads local filesv7.4.23symfony/serializer#[Ignore]v7.4.23symfony/validatorIpconstraint accepts IPv4-mapped IPv6v7.4.23symfony/yamlv7.4.23Testing focus
Deployment
Run
drush updbanddrush cimas part of the normal deploy. No manual steps beyond that.Package changes
4.10.5to4.10.6patch3.2.1to3.2.2patch3.1.2to3.1.3patch4.7.1to4.7.2patch2.0.11to2.0.12patch11.4.11to11.4.12patch - release notes11.4.11to11.4.12patch11.4.11to11.4.12patch1.3.0to1.3.1patch1.22.0to1.23.0minor2.2.5to2.2.6patch5.0.12to5.0.13patch1.10.0to1.11.0minor4.0.1to4.0.2patch2.10.1to2.12.0minor2.2.2to2.3.0minorv8.1.10tov8.1.11patchv3.7.1tov3.8.1minorv8.1.10tov8.1.11patchv7.4.22tov7.4.23patchv7.4.22tov7.4.23patchv7.4.21tov7.4.23patchv7.4.22tov7.4.23patchv7.4.22tov7.4.23patchv3.7.3tov3.8.1minorv7.4.22tov7.4.23patchv7.4.22tov7.4.23patchv7.4.22tov7.4.23patchv7.4.22tov7.4.23patchv7.4.22tov7.4.23patchv8.1.10tov8.1.11patchv7.4.22tov7.4.23patchv7.4.22tov7.4.23patchScreenshots
N/A
Summary by CodeRabbit